--- title: Knowledge Base Articles (KB) slug: solutions/knowledge-base-articles-kb docTags: createdAt: 2026-03-04T10:37:17.829Z --- **Knowledge Base Articles** (application **KB Article**) store institutional investigation guidance. Hero AI uses linked articles for **Generate Plan**, investigation steps, and verdict context. Create articles with the right **Scope** so each record applies only where it should. ## Choose Your Path | **If You Want To...** | **Go To** | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | Create a new KB article (UI steps) | [How to Create KB Articles](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#how-to-create-kb-articles) | | Decide Global versus source versus alert content | [Types of KB Articles](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#types-of-kb-articles) | | Understand **Scope** and **Matching Value** | [Scope: How Articles Match Cases](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#scope-how-articles-match-cases) | | Format **Guidance** for plan generation | [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP) | | Field reference | [Record Fields](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#record-fields) | | Copy-paste examples | [Examples by Scope](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#examples-by-scope) | ## How to Create KB Articles Use this workflow whenever you add or update a **KB Article** record in the tenant. ### Open the KB Application 1. Navigate to **Application Records** → **Knowledge Base Articles**. 2. Click **Add** to open **New Record** on the **Article** tab. ### Choose Scope Before You Write Pick the **narrowest** scope that fits your content. Do not put a single-alert runbook in **Global**, and do not put organization-wide tool lists in **Signal Name**. | **If your content is...** | **Set Scope to** | **Matching Value** | | ----------------------------------------------------------------------------- | ----------------- | ----------------------------------------------------- | | Organization tools, policies, whitelists, classification rules for all alerts | **Global** | Leave **empty** (not required for global KB articles) | | Default triage for one vendor or platform (all alerts from that source) | **Signal Source** | Exact **Signal Source** on the case (case-sensitive) | | Steps for one detection rule that covers several alert titles | **Signal Rule** | Exact rule name or ID on the case | | Full procedure for one alert title only | **Signal Name** | Exact **Signal Name** / alert name on the case | See [Types of KB Articles](https://docs.swimlane.com/solutions/NTgN-knowledge-base-articles-kb#types-of-kb-articles) for what to write in **Guidance** for each type. ### Complete Required Fields 1. Turn **Enabled** on when the article should be active. 2. Enter **Title** (required). Use a name that reflects scope (for example `Organization environment and tooling` or `JumpCloud login failure detected`). 3. Set **Record Type** to **Case Management** for AI SOC triage and **Generate Plan**. 4. Select **Category** (required): **Industry Frameworks**, **Best Practices**, or **Memos**. 5. Select **Scope** and **Matching Value** per the table above. 6. Enter **Context Summary** (recommended): one or two sentences on when this article applies. 7. Enter **Guidance** in the rich text editor: scope-appropriate content and investigation steps (see [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP)). 8. Set **Read Only** only if the record must not be edited. 9. Click **Save**. :::hint{type="info"} For non-global articles, **Matching Value** must match the case field exactly. If **Scope** is **Signal Source** but the value does not match the case **Signal Source**, the article does not auto-link and Hero AI may not use it for that alert. ::: ### Verify the Article Works This verification applies to **new** case records (for example a newly ingested test alert). Auto-linking and **Generate Plan** behavior may not reflect KB changes on cases that were created before the article was saved or updated. 1. Ingest a test alert or open a **new** **Case Management** case that should match the article. 2. Confirm the article appears under **Knowledge Base** on the case when scope and matching are correct. 3. Run **Generate Plan** and confirm steps reflect your **Guidance** and installed connectors. ## Types of KB Articles Good KB articles are **scoped**, **operational**, and **non-duplicative**: organization facts stay global, vendor behavior stays at **Signal Source**, and single-alert triage stays at **Signal Name** or **Signal Rule**. | **Type (authoring model)** | **Scope in the UI** | **What to include in Guidance** | **Do not include** | | -------------------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | **Global** | **Global** | Customer or tenant environment/tools: IdP, EDR, SIEM, ticketing; Swimlane connectors you use; default lookback (for example 24 hours, extend to seven days when findings are suspicious); approved domains, scanners, and break-glass notes; organization-wide classification principles (for example do not mark **Malicious** from threat intelligence alone without corroborating case evidence) | Steps for one alert title; full vendor-only runbooks (use **Signal Source**) | | **Source-specific** | **Signal Source** | What the product is; reliable and noisy fields; where to investigate in the console or SIEM; entity mapping (user, host, IP, process, hash); recommended enrichment order and Turbine components; common false positives for that source | Entire org tool list (use **Global**); login-failure-only logic for one title (use **Signal Name**) | | **Rule-specific** | **Signal Rule** | Procedures shared by alerts from the same detection rule (several alert names under one rule) | Org-wide policies (use **Global**); one-off alert title detail (use **Signal Name**) | | **Alert-specific** | **Signal Name** | What this alert usually means in your environment; numbered investigation steps; evidence to collect; **If \[condition], then classify as \[verdict]** rules (Benign, Suspicious, Malicious, Unknown); remediation when required | CrowdStrike-wide or Okta-wide steps (use **Signal Source**); org facts (use **Global**) | :::hint{type="warning"} **Do not bloat Global.** If your organization has hundreds of alert types, a single Global article cannot list login-failure logic, EDR process chains, and cloud exfiltration steps for each. Split content by **Signal Source**, **Signal Rule**, or **Signal Name**. ::: ## Scope: How Articles Match Cases On the KB record, **Scope** defines which case field is compared to **Matching Value**. | **Scope (UI)** | **Applies when** | **Matching Value** | | ----------------- | ------------------------------------------ | ---------------------------------------------------------- | | **Global** | Organization-wide context for all cases | Leave **empty** | | **Signal Source** | Any alert from one platform or integration | Exact **Signal Source** string (for example `CrowdStrike`) | | **Signal Rule** | Alerts from one detection rule | Exact rule identifier or name on the case | | **Signal Name** | One specific alert title only | Exact **Signal Name** / alert name | ## Record Fields | **Field** | **Required** | **Purpose** | | ------------------- | -------------------- | ------------------------------------------------------------------- | | **Title** | Yes | Human-friendly name. | | **Record Type** | Yes | Use **Case Management** for AI SOC and **Generate Plan**. | | **Category** | Yes | **Industry Frameworks**, **Best Practices**, or **Memos**. | | **Scope** | Yes | **Global**, **Signal Source**, **Signal Rule**, or **Signal Name**. | | **Matching Value** | Depends on **Scope** | Matched value on the case; empty for **Global**. | | **Context Summary** | Recommended | When the article applies. | | **Guidance** | Recommended | Procedures and classification rules ( **Article** tab). | | **Enabled** | — | Article is active when on. | | **Read Only** | — | Optional lock against edits. | The **Article** tab shows audit fields after save. **History** and **Support** tabs are available on saved records. ## What to Include in Guidance | **Topic** | **Why it matters** | | ------------------------------------- | ------------------------------------------------------------------- | | **Security control or platform role** | Helps Hero AI interpret alert context. | | **Use within Swimlane** | Connectors, components, and playbooks installed in your tenant. | | **Investigation steps** | Phase-based, one action per line, explicit product names. | | **Key data points** | Case or alert fields used for lookups. | | **Whitelists and blocklists** | Approved assets, domains, scanners, or patterns to treat as benign. | | **Classification principles** | Clear **If \[condition], then classify as \[verdict]** statements. | Reference only integrations installed in your tenant so plan generation does not suggest unavailable components. ## Examples by Scope ### Global — Organization Environment | **Field** | **Example value** | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Title** | Organization standards and tooling | | **Category** | Best Practices | | **Scope** | Global | | **Matching Value** | (empty) | | **Guidance** | JumpCloud for identity, CrowdStrike for endpoint, Elastic for SIEM, Jira for ticketing; use CrowdStrike components for hosts and JumpCloud for users; 24-hour lookback, seven days when suspicious; approved domains and internal scanners; do not classify **Malicious** from VirusTotal alone. | ### Signal Source — CrowdStrike Endpoint Security | **Field** | **Example value** | | ------------------- | ------------------------------------------------------------------------------------------------- | | **Title** | CrowdStrike endpoint security triage | | **Category** | Best Practices | | **Scope** | Signal Source | | **Matching Value** | `CrowdStrike` | | **Context Summary** | CrowdStrike is our endpoint platform; default steps for all CrowdStrike-sourced cases. | | **Guidance** | Enrichment order, Falcon queries, entity mapping, common false positives, containment components. | ### Signal Name — Login Failure | **Field** | **Example value** | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Title** | JumpCloud login failure detected | | **Category** | Best Practices | | **Scope** | Signal Name | | **Matching Value** | `JumpCloud login failure detected` | | **Guidance** | Compare login IP to usual ISP and working hours; if four or more consecutive failures or region differs from usual, favor **Malicious**; otherwise consider typo or benign. | ## Linking and Plan Generation - **Auto-link:** When **Scope** and **Matching Value** match case fields, the article can link automatically. - **Manual link:** Attach articles on the **Case Management** record during triage. - **Generate Plan:** Hero AI uses linked and matched **Context Summary** and **Guidance** when building investigation steps. ## Next Steps | **Topic** | **Guide** | | ------------------------------- | ---------------------------------------------------------------------------- | | **Guidance** format and phases | [KB Article Best Practices for Plan Generation](docId:7Zdgwrtvm6yI0lUnJL4JP) | | Add articles in daily workflows | [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-) | | Investigation plan phases | [Investigation Plan Workflow](docId\:BdE8P71Mmp2LByMuZuOOI) |